[Bro] Nodes still crashing/Site specific files

[Siwek, Jonathan Luke]

On Jun 13, 2013, at 11:03 AM, "Richards, James L - DOA" <James.Richards at wisconsin.gov> wrote:

> When performing a new installation, I would like to copy back my site-specific files with modifications, and it appears that some files live outside of the /usr/local/bro directory.

It can depend on how you configured/installed and on what OS, but if you're just doing a default build from source, then nothing should get installed outside /usr/local/bro.  What files did you find outside that dir?

>   Does anyone know offhand where I should look for these files.

This should be all of them:

/usr/local/bro/share/bro/site/local.bro 
/usr/local/bro/share/bro/site/local-manager.bro 
/usr/local/bro/share/bro/site/local-proxy.bro 
/usr/local/bro/share/bro/site/local-worker.bro 
/usr/local/bro/etc/broctl.cfg 
/usr/local/bro/etc/networks.cfg 
/usr/local/bro/etc/node.cfg 
/usr/local/bro/etc/broccoli.conf

> I have performed a new install, then copied the files from a previous working version of bro from the /usr/local/previous-bro/share/bro/site and /usr/local/previous-bro/spool/ directories to the current bro install…  but all of my nodes crash upon issuing the START command from broctl.

Copying the spool dir between installs isn't typical.  But you could use `broctl diag` to get more info about why the nodes don't start.

- Jon